felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Read-only root compatibility

Browse source
This commit is contained in:
nobodysu 2022-10-18 21:06:50 +03:00
parent 69e05ffb72
commit d4987b5bab
13 changed files with 43 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

10
apparmor.d/groups/network/NetworkManager
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}{,s}bin/NetworkManager @{exec_path} = /{usr/,}{,s}bin/NetworkManager
profile NetworkManager @{exec_path} flags=(attach_disconnected) { profile NetworkManager @{exec_path} flags=(complain attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-network-manager-strict> include <abstractions/dbus-network-manager-strict>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
@ -104,16 +104,15 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
/ r, / r,
/etc/ r, /etc/ r,
/etc/machine-id r, @{etc_rw}/resolv.conf rw,
/etc/resolv.conf rw, @{etc_rw}/resolv.conf.[0-9A-Z]* rw,
/etc/resolv.conf.[0-9A-Z]* rw,
/etc/network/interfaces r, /etc/network/interfaces r,
/etc/network/interfaces.d/{,*} r, /etc/network/interfaces.d/{,*} r,
/etc/NetworkManager/{,**} r, /etc/NetworkManager/{,**} r,
/etc/NetworkManager/system-connections/{,**} w, /etc/NetworkManager/system-connections/{,**} w,
/var/lib/iwd/*open* rw, /etc/machine-id r,
/var/lib/NetworkManager/{,**} rw, /var/lib/NetworkManager/{,**} rw,
@{sys}/bus/ r, @{sys}/bus/ r,
@ -136,7 +135,6 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/pci[0-9]*/**/net/*/{,**} r, @{sys}/devices/pci[0-9]*/**/net/*/{,**} r,
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/net/{,**} r, @{sys}/devices/pci[0-9]*/**/usb[0-9]/**/net/{,**} r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/stat r, @{PROC}/@{pids}/stat r,
@{PROC}/1/environ r, @{PROC}/1/environ r,

8
apparmor.d/groups/network/mullvad-daemon
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = "/opt/Mullvad VPN/resources/mullvad-daemon" @{exec_path} = "/opt/Mullvad VPN/resources/mullvad-daemon"
profile mullvad-daemon @{exec_path} flags=(attach_disconnected) { profile mullvad-daemon @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -36,8 +36,8 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
/etc/mullvad-vpn/{,*} r, /etc/mullvad-vpn/{,*} r,
/etc/mullvad-vpn/*.json rw, /etc/mullvad-vpn/*.json rw,
/etc/resolv.conf rw, @{etc_rw}/resolv.conf rw,
/etc/resolv.conf.mullvadbackup rw, @{etc_rw}/resolv.conf.mullvadbackup rw,
/var/cache/mullvad-vpn/{,*} rw, /var/cache/mullvad-vpn/{,*} rw,
/var/log/mullvad-vpn/{,*} rw, /var/log/mullvad-vpn/{,*} rw,
@ -59,4 +59,4 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
/dev/net/tun rw, /dev/net/tun rw,
include if exists <local/mullvad-daemon> include if exists <local/mullvad-daemon>
} }

12
apparmor.d/groups/network/tailscaled
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}{,s}bin/tailscaled @{exec_path} = /{usr/,}{,s}bin/tailscaled
profile tailscaled @{exec_path} flags=(attach_disconnected) { profile tailscaled @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
@ -37,9 +37,9 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) {
/etc/iproute2/rt_tables r, /etc/iproute2/rt_tables r,
/etc/resolv.*.conf rw, @{etc_rw}/resolv.*.conf rw,
/etc/resolv.conf rw, @{etc_rw}/resolv.conf rw,
/etc/resolv.conf.*.tmp rw, @{etc_rw}/resolv.conf.*.tmp rw,
owner @{run}/tailscale/{,**} rw, owner @{run}/tailscale/{,**} rw,
owner /var/cache/{,**} rw, owner /var/cache/{,**} rw,
@ -63,7 +63,7 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) {
/dev/net/tun rw, /dev/net/tun rw,
profile systemctl { profile systemctl flags=(attach_disconnected complain) {
include <abstractions/base> include <abstractions/base>
capability mknod, capability mknod,
@ -80,4 +80,4 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) {
} }
include if exists <local/tailscaled> include if exists <local/tailscaled>
} }

6
apparmor.d/groups/systemd/systemd-timedated
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-timedated @{exec_path} = /{usr/,}lib/systemd/systemd-timedated
profile systemd-timedated @{exec_path} flags=(attach_disconnected) { profile systemd-timedated @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/systemd-common> include <abstractions/systemd-common>
@ -34,8 +34,8 @@ profile systemd-timedated @{exec_path} flags=(attach_disconnected) {
/dev/rtc[0-9] r, /dev/rtc[0-9] r,
/etc/.#adjtime* rw, @{etc_rw}/.#adjtime* rw,
/etc/adjtime rw, @{etc_rw}/adjtime rw,
/etc/.#localtime* rw, /etc/.#localtime* rw,
/etc/localtime rw, /etc/localtime rw,

4
apparmor.d/groups/systemd/systemd-timesyncd
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-timesyncd @{exec_path} = /{usr/,}lib/systemd/systemd-timesyncd
profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) { profile systemd-timesyncd @{exec_path} flags=(complain attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -31,7 +31,7 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
/etc/adjtime r, @{etc_rw}/adjtime r,
/etc/systemd/timesyncd.conf r, /etc/systemd/timesyncd.conf r,
/etc/systemd/timesyncd.conf.d/{,**} r, /etc/systemd/timesyncd.conf.d/{,**} r,

10
apparmor.d/groups/virt/libvirtd
View file

@ -15,7 +15,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/libvirtd @{exec_path} = /{usr/,}{s,}bin/libvirtd
profile libvirtd @{exec_path} flags=(attach_disconnected) { profile libvirtd @{exec_path} flags=(attach_disconnected complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/dbus> include <abstractions/dbus>
@ -132,8 +132,8 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
/usr/share/mime/mime.cache r, /usr/share/mime/mime.cache r,
/usr/share/qemu/{,**} r, /usr/share/qemu/{,**} r,
/etc/apparmor.d/libvirt/libvirt-@{uuid} r, @{etc_rw}/apparmor.d/libvirt/libvirt-@{uuid} r,
/etc/libvirt/{,**} rw, @{etc_rw}/libvirt/{,**} rw,
/etc/mdevctl.d/{,**} r, /etc/mdevctl.d/{,**} r,
/etc/xml/catalog r, /etc/xml/catalog r,
@ -243,12 +243,12 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
# Force the use of virt-aa-helper # Force the use of virt-aa-helper
audit deny /{usr/,}{s,}bin/apparmor_parser rwxl, audit deny /{usr/,}{s,}bin/apparmor_parser rwxl,
audit deny /etc/apparmor.d/libvirt/** wxl, audit deny @{etc_rw}/apparmor.d/libvirt/** wxl,
audit deny @{sys}/kernel/security/apparmor/features rwxl, audit deny @{sys}/kernel/security/apparmor/features rwxl,
audit deny @{sys}/kernel/security/apparmor/matching rwxl, audit deny @{sys}/kernel/security/apparmor/matching rwxl,
audit deny @{sys}/kernel/security/apparmor/.* rwxl, audit deny @{sys}/kernel/security/apparmor/.* rwxl,
profile qemu_bridge_helper { profile qemu_bridge_helper flags=(attach_disconnected complain) {
include <abstractions/base> include <abstractions/base>
capability net_admin, capability net_admin,

4
apparmor.d/groups/virt/virt-aa-helper
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}lib/libvirt/virt-aa-helper @{exec_path} = /{usr/,}lib/libvirt/virt-aa-helper
profile virt-aa-helper @{exec_path} { profile virt-aa-helper @{exec_path} flags=(complain ) {
include <abstractions/base> include <abstractions/base>
include <abstractions/openssl> include <abstractions/openssl>
@ -23,7 +23,7 @@ profile virt-aa-helper @{exec_path} {
/{usr/,}{s,}bin/apparmor_parser rPx, /{usr/,}{s,}bin/apparmor_parser rPx,
/etc/apparmor.d/libvirt/* r, /etc/apparmor.d/libvirt/* r,
/etc/apparmor.d/libvirt/libvirt-@{uuid} rw, @{etc_rw}/apparmor.d/libvirt/libvirt-@{uuid} rw,
/etc/libnl{,-3}/classid r, # Allow reading libnl's classid file /etc/libnl{,-3}/classid r, # Allow reading libnl's classid file

6
apparmor.d/profiles-a-f/blkid
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/blkid @{exec_path} = /{usr/,}{s,}bin/blkid
profile blkid @{exec_path} { profile blkid @{exec_path} flags=(complain ) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/disks-read> include <abstractions/disks-read>
@ -23,8 +23,8 @@ profile blkid @{exec_path} {
@{run}/blkid/blkid.tab{,-*} rw, @{run}/blkid/blkid.tab{,-*} rw,
@{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab, @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
# When the system doesn't have the /run/ dir, the cache file is placed under /etc/ # When the system doesn't have the /run/ dir, the cache file is placed under /etc/
/etc/blkid.tab{,-*} rw, @{etc_rw}/blkid.tab{,-*} rw,
/etc/blkid.tab.old rwl -> /etc/blkid.tab, @{etc_rw}/blkid.tab.old rwl -> /etc/blkid.tab,
# For the EVALUATE=scan method # For the EVALUATE=scan method
@{PROC}/partitions r, @{PROC}/partitions r,

10
apparmor.d/profiles-a-f/dhclient-script
View file

@ -8,7 +8,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/dhclient-script @{exec_path} = /{usr/,}{s,}bin/dhclient-script
profile dhclient-script @{exec_path} { profile dhclient-script @{exec_path} flags=(complain ) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice> include <abstractions/nameservice>
include <abstractions/openssl> include <abstractions/openssl>
@ -50,9 +50,9 @@ profile dhclient-script @{exec_path} {
/etc/fstab r, /etc/fstab r,
/etc/iproute2/rt_tables r, /etc/iproute2/rt_tables r,
/etc/iproute2/rt_tables.d/{,*} r, /etc/iproute2/rt_tables.d/{,*} r,
/etc/resolv.conf rw, @{etc_rw}/resolv.conf rw,
/etc/resolv.conf.dhclient-new.@{pid} rw, @{etc_rw}/resolv.conf.dhclient-new.@{pid} rw,
/etc/samba/dhcp.conf{,.new} rw, @{etc_rw}/samba/dhcp.conf{,.new} rw,
/var/lib/dhcp/dhclient.leases r, /var/lib/dhcp/dhclient.leases r,
/var/lib/samba/dhcp.conf{,.new} rw, /var/lib/samba/dhcp.conf{,.new} rw,
@ -68,7 +68,7 @@ profile dhclient-script @{exec_path} {
owner @{PROC}/@{pid}/loginuid r, owner @{PROC}/@{pid}/loginuid r,
@{PROC}/sys/net/ipv6/conf/*/stable_secret w, @{PROC}/sys/net/ipv6/conf/*/stable_secret w,
profile run-parts { profile run-parts flags=(complain ) {
include <abstractions/base> include <abstractions/base>
/{usr/,}bin/run-parts mr, /{usr/,}bin/run-parts mr,

4
apparmor.d/profiles-g-l/lvm
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/lvm @{exec_path} = /{usr/,}{s,}bin/lvm
profile lvm @{exec_path} { profile lvm @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
@ -19,7 +19,7 @@ profile lvm @{exec_path} {
@{exec_path} rm, @{exec_path} rm,
/etc/lvm/** r, @{etc_rw}/lvm/** r,
@{run}/lvm/** rwk, @{run}/lvm/** rwk,
@{run}/lock/lvm/* rwk, @{run}/lock/lvm/* rwk,

5
apparmor.d/profiles-g-l/lvmconfig
View file

@ -7,14 +7,13 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/lvmconfig @{exec_path} = /{usr/,}{s,}bin/lvmconfig
profile lvmconfig @{exec_path} { profile lvmconfig @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
@{exec_path} rm, @{exec_path} rm,
/etc/lvm/** rw, @{etc_rw}/lvm/** rw,
include if exists <local/lvmconfig> include if exists <local/lvmconfig>
} }

4
apparmor.d/profiles-m-r/polipo
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}bin/polipo @{exec_path} = /{usr/,}bin/polipo
profile polipo @{exec_path} { profile polipo @{exec_path} flags=(complain ) {
include <abstractions/base> include <abstractions/base>
@{exec_path} mr, @{exec_path} mr,
@ -22,7 +22,7 @@ profile polipo @{exec_path} {
owner @{HOME}/.polipo-cache/{,*} rw, owner @{HOME}/.polipo-cache/{,*} rw,
# Nameservice # Nameservice
/etc/resolv.conf r, @{etc_rw}/resolv.conf r,
include if exists <local/polipo> include if exists <local/polipo>
} }

6
apparmor.d/profiles-m-r/resolvconf
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}sbin/resolvconf @{exec_path} = /{usr/,}sbin/resolvconf
profile resolvconf @{exec_path} { profile resolvconf @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -26,7 +26,7 @@ profile resolvconf @{exec_path} {
/usr/lib/resolvconf/{,**} r, /usr/lib/resolvconf/{,**} r,
/etc/resolv.conf rw, @{etc_rw}/resolv.conf rw,
/etc/resolvconf/{,**} r, /etc/resolvconf/{,**} r,
/etc/resolvconf/update.d/libc rix, /etc/resolvconf/update.d/libc rix,
@ -36,4 +36,4 @@ profile resolvconf @{exec_path} {
/dev/tty rw, /dev/tty rw,
include if exists <local/resolvconf> include if exists <local/resolvconf>
} }